Digital Forensics and Incident Response - Second Edition

Summary

Evidence that is pertinent to incident responders is not just located on the hard drive of a compromised host. There is a wealth of information available from network devices spread throughout the environment. With proper preparation, a CSIRT may be able to leverage the evidence provided by these devices through solutions such as an SIEM. CSIRT personnel also have the ability to capture network traffic for later analysis through a variety of methods and tools. Behind all of these techniques, though, are legal and policy implications that CSIRT personnel and the organization at large need to navigate. By preparing for the legal and technical challenges of network evidence collection, CSIRT members can leverage this evidence and move ...